TrustComponent
PHP
TrustCaptcha · Bot protection

PHP CAPTCHA Integration

Add a PHP CAPTCHA that protects forms, logins and checkouts from bots and spam. Our PHP package checks each TrustCaptcha result on your server, and from the Solo plan you also get a bot score and custom security rules. EU-hosted, GDPR-compliant and without puzzles for your visitors.

Quickstart

How the integration works

1. Create a CAPTCHA

Create a user account or log in with an existing one. Then create a new CAPTCHA or pick an existing one. If you want to try TrustCaptcha first, every plan comes with a 14-day free trial.

The CAPTCHA overview page shows your site key and license key, and you create your API key there. Add your website’s domains to the authorized domains in the CAPTCHA security rules so they can use your CAPTCHA.

Start of the CAPTCHA creation form.
CAPTCHA security rules of a demo CAPTCHA.

2. Integrate the CAPTCHA widget into your frontend

Integrate the CAPTCHA widget into your website or app. The CAPTCHA widget guide in our documentation has step-by-step instructions.

Read the documentation

The CAPTCHA widget will then be displayed on your website or app:

CAPTCHA start

Pre-built frontend integrations
Our pre-built frontend integrations add the CAPTCHA widget to your website or application. If there is none for your frontend technology yet, your developers can integrate the widget themselves using our documentation or ask our support team for a pre-built integration.

Angular
Contact Form 7
Craft CMS
JavaScript
Joomla
JTL-Shop
Keycloak
Magento 2
React
Shopware 6
Svelte
TYPO3
Vue
Webflow
WordPress

3. Validate the CAPTCHA result in your backend

The following steps show how a PHP backend fetches the CAPTCHA verification result from our server and decides what to do with it. For the full instructions, read the CAPTCHA integration guide for PHP in our documentation.

Read the documentation

First, install our TrustCaptcha PHP dependency:

Install
bash
composer require trustcomponent/trustcaptcha-php

Fetch the verification result from our server with the verification token and your API key:

Fetch Result
PHP
// Retrieving the verification result
$verificationResult = null;
try {
  $trustCaptcha = new TrustCaptcha("<your_api_key>");
  $verificationResult = $trustCaptcha->getVerificationResult("<verification_token_from_your_client>");
} catch (Exception $e) {
  // Fetch verification result failed - handle error
}

Based on the verification result and your own requirements, decide how to proceed:

Handle Result
PHP
// Act on the verification result
if (!$verificationResult->verificationPassed || $verificationResult->score > 0.5) {
  // Verification failed or bot score > 0.5 - possible automated request
}

Need detailed information about the PHP CAPTCHA integration?
Our PHP CAPTCHA integration guide has the detailed instructions, and our CAPTCHA samples repository on GitHub has a complete integration example.

Other backend technology instead of PHP?
If you run something other than PHP on your server, or have several backends, pick a different integration here. If we have no pre-built integration for your backend technology yet, your developers can integrate the CAPTCHA verification themselves using our documentation or ask our support team for a pre-built integration.

.NET
Go
Groovy
Java
Kotlin
Node.js
PHP
Python
Ruby
Rust
Scala

4. Test your integration

TrustCaptcha is now active. Send a test request and check that it goes through.

CAPTCHA done

FAQs

What does the PHP CAPTCHA integration do?
The PHP integration validates a TrustCaptcha verification token on your server. Your PHP backend fetches the verification result from TrustCaptcha and then decides whether to accept, further check, or block the request.
Do I still need to integrate the CAPTCHA widget in my frontend?
Yes. The verification token is created in your frontend (website or app) when the CAPTCHA is solved. The PHP part only verifies that token on the server.
How do I send the verification token to my PHP backend?
Send it in any way that fits your application, for example as a form field or in a JSON request. A common default name in classic forms is "tc-verification-token", but you can choose your own field name.
What do I need to validate a token in PHP?
You need the verification token from the frontend and your CAPTCHA API key from the TrustCaptcha dashboard. With both, your server can request the verification result from TrustCaptcha.
How should I make a decision based on the verification result?
Always check "verificationPassed" first. If you also want more control, use the bot score (0.0 = very likely human, 1.0 = very likely bot) and start with a threshold like 0.5, then adjust it to your risk and use case.
How long is a verification token valid, and can it be used more than once?
By default, the verification token is single-use and valid for 15 minutes. On the Enterprise plan you can extend the validity and allow a limited number of retrievals.
Losing leads to CAPTCHAs?

TrustCaptcha blocks spam and bots, not customers. No puzzles, GDPR-compliant, EU-hosted.

CAPTCHA start
CAPTCHA done
No puzzles for visitors
The check runs in the background while visitors type, so more people finish your forms instead of giving up.
GDPR-compliant
Hosted in the EU, no cookies, encrypted transmission and automatic data deletion. Every customer gets a Data Processing Agreement.
Multi-layer security
Adaptive proof-of-work and risk scoring stop abuse early, even when attack traffic spikes.
Full control
Set the sensitivity, keep allow and block lists and use geoblocking. You decide how strict the check is.

Protect your PHP application with TrustCaptcha in just a few steps!

  • EU-hosted & GDPR-compliant
  • No puzzles
  • Try free for 14 days
Get started Contact sales